Back to overview

CVE-2024-55662

CRITICAL Exploitation: PoC
10.0
CVSS 3.1
Description
XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where `Extension Repository Application` is installed, any user can execute any code requiring `programming` rights on the server. This vulnerability has been fixed in XWiki 15.10.9 and 16.3.0. Since `Extension Repository Application` is not mandatory, it can be safely disabled on instances that do not use it as a workaround. It is also possible to manually apply the patches from commit 8659f17d500522bf33595e402391592a35a162e8 to the page `ExtensionCode.ExtensionSheet` and to the page `ExtensionCode.ExtensionAuthorsDisplayer`.

Metadata

CVE ID
CVE-2024-55662
State
PUBLISHED
Assigner
GitHub_M
Reserved
2024-12-10 15:33 UTC
Published
2024-12-12 17:25 UTC
Last updated
2024-12-13 14:59 UTC
Primary CWE
CWE-96
CWE-96: Improper Neutralization of Directives in Statically …
Vendor / Product
xwiki / xwiki-platform
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
xwiki xwiki-platform — >= 3.3-milestone-1, < 15.10.9, >= 16.0.0-rc-1, < 16.3.0
Weakness (CWE)
CWESourceDescription
CWE-863 cna CWE-863: Incorrect Authorization
CWE-96 cna CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References (3)
Back to overview